01 HTML Attacks Normal Javascript Pastejacking A baseline pastejacking demo using standard JavaScript. Copy and paste the commands into a notepad to see how the clipboard is tampered HTML View demo → Evil Font Pastejacking The same pastejacking attack, now powered by evil fonts. Uses evil fonts instead of JavaScript to manipulate what is copied. Take a look at the source to see how gross it is. HTML View demo → 02 Document Injection Help Desk Document Poisoning (.docx) A crafted .docx file that is used by the HelpDesk of a target company. Evil fonts can be used to tamper the docx file without making any visible changes. Try copying out the lines that are marked as EVIL FONT DEMO COMMAND to see how the text changes. Take extra note how tiny invisible fonts let the attacker insert extra newlines into the powershell command. DOCX View demo → 03 AI Deception Evil Resume (DOCX) A resume for Spongebob Square Pants that uses Evil Fonts to defeat AI resume filters for a red team position. Try copy and pasting lines to see what the AI filter sees. Or, select the whole document and change the font to a system font. DOCX View demo → Evil Resume (PDF) A resume for Spongebob Square Pants that uses invisible text over a png of a word doc. Created using evilfontool's DOCX to PDF conversion to defeat AI resume filters for a red team position. Try copy and pasting lines to see what the AI filter sees. PDF View demo → Extortion Note (DOCX) A document that appears to extort a human reader, but when analysed by a security tool it is marked as safe. Try copy and pasting lines to see what the AI filter sees. Or, select the whole document and change the font to a system font. DOCX View demo → Extortion Note (PDF) A document that appears to extort a human reader, but when analysed by a security tool it is marked as safe. Created using evilfontool's DOCX to PDF conversion by layering invisible text over a png copy word doc. Try copy and pasting lines to see what the AI filter sees. PDF View demo →